A critical vulnerability in Apple’s macOS Screen Sharing feature has been actively exploited to deploy cryptocurrency mining malware on internet-exposed systems. The flaw, identified as CVE-2026-65400 with a CVSS score of 9.8, allows attackers to authenticate to the remote desktop service without valid credentials, potentially leading to unauthorized access and control.
Apple addressed this security issue in early August 2026 by releasing emergency updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. These updates improved state management mechanisms to enforce proper credential validation, thereby preventing unauthorized authentication attempts.
The Netherlands National Cyber Security Centre (NCSC-NL) has reported active exploitation of this vulnerability. Attackers have targeted systems with port 5900 exposed to the internet, gaining root access and installing Monero cryptocurrency miners. The NCSC-NL’s advisory highlights the severity of the situation, urging users to apply the necessary updates promptly.
Security researcher Alfredo Pesoli of Bynario, credited with discovering the flaw, detailed that the issue involves a legacy authentication path in the Screen Sharing service. This path allows an attacker, already in possession of the VNC password, to perform file operations with root privileges. By exploiting this, attackers can read protected files and create files as root, leading to remote command execution.
Further analysis by security researcher @osxreverser suggests that the vulnerability may be exploited even without prior knowledge of the VNC password. This pre-authentication flaw in the Screen Sharing daemon could enable attackers to compromise any Mac with Screen Sharing enabled, provided they know the system’s IP address.
In addition to CVE-2026-65400, Apple addressed several other vulnerabilities in the Screen Sharing Server component with the release of macOS Tahoe 26.6. These include:
- CVE-2026-43779 (CVSS score: 9.8): A logic issue allowing an app to intercept network connections intended for another process.
- CVE-2026-43777 (CVSS score: 7.5): An issue that could allow a remote attacker to cause a denial-of-service (DoS).
- CVE-2026-43760 (CVSS score: 8.6): An access issue that could allow an app to access user-sensitive data.
These vulnerabilities underscore the importance of maintaining up-to-date systems and exercising caution with remote access features. Users are strongly advised to apply the latest security updates and consider disabling Screen Sharing if it is not essential. This incident highlights the ongoing risks associated with exposed remote access services and the necessity for robust security practices to protect against unauthorized access and potential malware deployment.
